Here's a type of policy I've not seen before, appended to the specification sheet for an electronic component made by National: LIFE SUPPORT POLICY NATIONAL’S PRODUCTS ARE NOT AUTHORIZED FOR USE AS CRITICAL COMPONENTS IN LIFE SUPPORT DEVICES OR SYSTEMS WITHOUT THE EXPRESS WRITTEN APPROVAL OF THE PRESIDENT AND GENERAL COUNSEL OF NATIONAL SEMICONDUCTOR CORPORATION. As used herein: 1. Life support devices or systems are devices or systems which, (a) are intended for surgical implant into the body, or (b) support or sustain life, and whose failure to perform when properly used in accordance with instructions for use provided in the labeling, can be reasonably expected to result in a significant injury to the user. 2. A critical component is any component of a life support device or system whose failure to perform can be reasonably expected to cause the failure of the life support device or system, or to affect its safety or effectiveness. I'm looking forward to readin...

If you are keen to learn about security metrics and perhaps even design or at least refine your own information security measurement system, I recommend Krag Brotby's thought-provoking book Information Security Management Metrics: A Definitive Guide to Effective Security Monitoring and Measurement .  Managing information security properly demands the use of suitable metrics at all levels from defining security strategy and governance, through prioritizing resources and investing in security, down to decision support for a million day-to-day operational security management decisions.  Krag's book won't give you a checklist of things to measure, but it will lay the groundwork and set you up to define your own metrics shortlist.  If you are using the ISO27k standards and plan to adopt the metrics advice in ISO/IEC 27004 , make the time to read Krag's book before you dive right in at the deep end.

A neighbour called me yesterday about a suspicious phone call she received from someone claiming that she had a problem with her PC.  The caller, who apparently sounded Indian, asked her to switch on her PC so he could help her sort it out.  Thanksfully she had the awareness to notice something amiss.  The caller mumbled who he was working for and wouldn't clarify.  When she told him she needed to verify his identity, he terminated the call .... and presumably went on to try to scam some less-savvy sucker. The NZ government's ScamWatch site is warning of this exact scam :  "Scamwatch continues to receive a steady stream of reports from consumers about out-of-the-blue phone calls from scammers wanting remote access to your computer to 'get rid of viruses' or to 'fix' your computer ... The calls, which appear to be originating overseas, ask consumers for remote access to their PC to 'see if their computer is infected'.  The scammer claims to be ...

News that Google employees are to be treated to a security awareness program from next month is a positive move, but makes me wonder exactly what the sleepy giant has been doing up til now.  Google has been rightly criticized for several privacy breaches already, with the WiFi data captured by Google's snooper vans a recent example that is still rumbling on.  The news piece on TechShout implies that Google's awareness program will cover privacy, but makes no mention of the myriad other information security issues.  Personally, given Google's lackluster response to the privacy complaints, I get the distinct feeling that Google's management just don't get security. I just hope Google's awareness program has messages for management as well as the workforce.

The thumbnail shows the first of a series of 6 posters in November's security awareness module on social engineering.  It's a particularly important topic for us because security awareness is by far the most important control against social engineering.  Alert employees who appreciate the threat and know what to do if they feel they are being targeted stand a much better chance of resisting attacks than those who remain blissfully unaware throughout. As always, the newsletter sets the scene for the topic and outlines the risks associated with exploiting people rather than technologies.  The social engineering capture-the-flag competition at this year's DefCon hacker conference was a real eye-opener for many: we couldn't help but notice a number of prominent organizations hastily sending out warning notices to their employees ahead of the CTF competition, even though the rules of the game were strictly limited to keep the event ethical and educational.  What's more,...

I wrote the following piece in response to a request for input by David Lacey on his blog .  David and other luminaries in ISSA-UK had a meeting to discuss what they feel are the biggest security challenges we'll face in the decade ahead.  An ISSA White Paper is planned at the end of this year, so it would be good for the wider infosec community to collaborate on this. I composed the following as a reply to David's blog but for some reason the ComputerWeekly site refuses to accept it.  Perhaps it's too long or goes against their editorial principles, who knows?   Anyway, here's what I wrote ... FWIW my main concern for the decade ahead is the increasing power and resourcing of the black hat community - not so much the lone home hackers and hacker clubs (who are formidable but rather fragmented and from what I've seen relatively benign, well-meaning even in some cases) but the true criminal community that increasingly uses hacking and social engineering to harves...

Thanks to someone on CISSPforum, here's a gift idea for busy, well-connected friends on your holiday list - a password directory : "There are user IDs and passwords to remember everywhere you turn. There are codes and passwords for a variety of Web sites, bank accounts, frequent traveler programs and voicemail systems. It's tough to keep track of them all! Our Password Directory can help. It's alphabetically organized to log the user name, password or a password hint for any number of applications. It's a thoughtful gift for the busy, well-connected friends on your holiday list."   Unbelievable!  Well, actually it's entirely credible. Worryingly, there probably is a market for products like this, at least among the clueless buying for the security unaware. I'm puzzled as to the evident lack of general interest in or uptake of secure 'password vault' programs which neatly solve the most awkward and annoying aspects of the passwor...